Cyber Resilience Engineer
When to Use
- Define RTO/RPO and recovery tiers for production, security, and identity services
- Design backup, restore, and immutability architecture (object lock, air-gap, WORM, vault isolation)
- Map critical service dependencies and failure domains for continuity during attacks
- Author attack-scenario playbooks (ransomware, wiper, IdP loss, logging blind spot, cloud control-plane)
- Plan and run resilience tests—restore drills, game days, chaos/failure injection with pass/fail evidence
- Align engineering deliverables with NIST CSF Recover and BCM/IR interfaces
- Produce resilience metrics and engineering briefs for leadership and audit consumers
When NOT to Use
- Own enterprise BCM program, BIA facilitation, and regulatory BCM policy →
bcm-disaster-recovery-specialist
- Lead active incident war room, containment, and forensic preservation →
incident-responder
- Define SEV matrices, paging policy, and status-page program →
incident-management-engineer
- Operate SLIs, SLOs, error budgets, and capacity toil without recovery design →
site-reliability-engineer
- Execute ticket-level snapshots and restores without resilience architecture →
cloud-system-administrator
- Control-by-control audit evidence and framework mapping only →
compliance-specialist
- Board-level security strategy and risk appetite without engineering recovery →
chief-information-security-officer
- Broad security program ownership without resilience engineering →
cybersecurity
- Greenfield cloud landing zone without recovery lens →
cloud-engineer (pair for placement; you own RTO/RPO fit)
Related skills
| Need |
Skill |
| BCM/DR program, BIA, tabletops, crisis comms cadence |
bcm-disaster-recovery-specialist |
| Active CSIRT response, containment, timelines |
incident-responder |
| Incident program, SEV, on-call, postmortem process |
incident-management-engineer |
| SLO impact, reliability mitigation, error budgets |
site-reliability-engineer |
| Backup/restore execution, snapshots, operational hygiene |
cloud-system-administrator |
| SIEM/EDR/IdP/KMS implementation and hardening |
information-security-engineer |
| Security program, IR policy, executive narratives |
cybersecurity |
| CISO strategy, board reporting, risk appetite |
chief-information-security-officer |
| Cloud architecture, DR regions, service selection |
cloud-engineer |
Core Workflows
1. Scope and engineering charter
Clarify resilience boundaries, ownership, and interfaces with BCM, IR, SRE, and platform teams.
See references/cyber_resilience_scope.md.
2. Recovery objectives and tiers
Set RTO/RPO, tiering, and recovery strategies with explicit trade-offs and test hooks.
See references/recovery_objectives_and_tiers.md.
3. Backup, restore, and immutability
Design backup topology, isolation, encryption, and restore validation for cyber events.
See references/backup_restore_and_immutability.md.
4. Resilience testing and chaos
Plan game days, restore drills, and controlled failure injection with evidence and remediation.
See references/resilience_testing_and_chaos.md.
5. Attack scenarios and playbooks
Engineer playbooks for ransomware, destructive malware, identity and logging loss, and cloud control-plane failure.
See references/attack_scenarios_and_playbooks.md.
6. Metrics, reporting, and governance
Track RTA vs RTO, restore success, test coverage, and NIST CSF Recover alignment for stakeholders.
See references/metrics_reporting_and_governance.md.
Outputs
- Resilience architecture — tiers, dependencies, backup/immutability design, failure domains
- RTO/RPO register — per service with strategy, owner, last test, and known gaps
- Playbook pack — attack-scenario sequences with decision gates and IR handoffs
- Test report — scope, RTA/RPO achieved, integrity checks, findings, remediation backlog
- Chaos/game-day summary — hypothesis, blast radius, controls validated, follow-ups
- Resilience dashboard brief — KPIs, trend, top risks (engineering lens; not legal advice)
Principles
- Engineer for compromise — assume attacker presence; prefer rebuild and immutable recovery paths
- Test restores, not jobs — backup success ≠ recoverable; measure RTA and data integrity
- Recover security first — identity, logging, and detection before convenience workloads
- Separate roles — resilience engineering complements BCM policy and IR command
- Evidence by design — every tier and playbook links to a test or exercise with dated results
1---2name: cyber-resilience-engineer3description: Designs and operates cyber resilience capabilities—RTO/RPO architecture, backup/restore and immutable backup patterns, dependency mapping for critical services, crisis playbooks for ransomware, destructive malware, and cloud control-plane loss, chaos and failure injection for security-relevant failures, resilience testing with evidence, and alignment with NIST CSF Recover and business continuity. Use when engineering recovery objectives and tiers, designing backup immutability and restore validation, running resilience or chaos tests, mapping attack-scenario playbooks, reporting resilience metrics, or sustaining continuity during active attacks—not enterprise BCM program ownership alone (bcm-disaster-recovery-specialist), live incident command (incident-responder), SRE performance and toil only (site-reliability-engineer), backup operator runbooks without architecture (cloud-system-administrator), GRC audit prep only (compliance-specialist), or CISO board strategy (chief-information-security-officer).4---56# Cyber Resilience Engineer78## When to Use910- Define **RTO/RPO** and recovery tiers for production, security, and identity services11- Design **backup, restore, and immutability** architecture (object lock, air-gap, WORM, vault isolation)12- Map **critical service dependencies** and failure domains for continuity during attacks13- Author **attack-scenario playbooks** (ransomware, wiper, IdP loss, logging blind spot, cloud control-plane)14- Plan and run **resilience tests**—restore drills, game days, chaos/failure injection with pass/fail evidence15- Align engineering deliverables with **NIST CSF Recover** and BCM/IR interfaces16- Produce **resilience metrics** and engineering briefs for leadership and audit consumers1718## When NOT to Use1920- Own enterprise BCM program, BIA facilitation, and regulatory BCM policy → `bcm-disaster-recovery-specialist`21- Lead active incident war room, containment, and forensic preservation → `incident-responder`22- Define SEV matrices, paging policy, and status-page program → `incident-management-engineer`23- Operate SLIs, SLOs, error budgets, and capacity toil without recovery design → `site-reliability-engineer`24- Execute ticket-level snapshots and restores without resilience architecture → `cloud-system-administrator`25- Control-by-control audit evidence and framework mapping only → `compliance-specialist`26- Board-level security strategy and risk appetite without engineering recovery → `chief-information-security-officer`27- Broad security program ownership without resilience engineering → `cybersecurity`28- Greenfield cloud landing zone without recovery lens → `cloud-engineer` (pair for placement; you own RTO/RPO fit)2930## Related skills3132| Need | Skill |33|---|---|34| BCM/DR program, BIA, tabletops, crisis comms cadence | `bcm-disaster-recovery-specialist` |35| Active CSIRT response, containment, timelines | `incident-responder` |36| Incident program, SEV, on-call, postmortem process | `incident-management-engineer` |37| SLO impact, reliability mitigation, error budgets | `site-reliability-engineer` |38| Backup/restore execution, snapshots, operational hygiene | `cloud-system-administrator` |39| SIEM/EDR/IdP/KMS implementation and hardening | `information-security-engineer` |40| Security program, IR policy, executive narratives | `cybersecurity` |41| CISO strategy, board reporting, risk appetite | `chief-information-security-officer` |42| Cloud architecture, DR regions, service selection | `cloud-engineer` |4344## Core Workflows4546### 1. Scope and engineering charter4748Clarify resilience boundaries, ownership, and interfaces with BCM, IR, SRE, and platform teams.4950**See `references/cyber_resilience_scope.md`.**5152### 2. Recovery objectives and tiers5354Set RTO/RPO, tiering, and recovery strategies with explicit trade-offs and test hooks.5556**See `references/recovery_objectives_and_tiers.md`.**5758### 3. Backup, restore, and immutability5960Design backup topology, isolation, encryption, and restore validation for cyber events.6162**See `references/backup_restore_and_immutability.md`.**6364### 4. Resilience testing and chaos6566Plan game days, restore drills, and controlled failure injection with evidence and remediation.6768**See `references/resilience_testing_and_chaos.md`.**6970### 5. Attack scenarios and playbooks7172Engineer playbooks for ransomware, destructive malware, identity and logging loss, and cloud control-plane failure.7374**See `references/attack_scenarios_and_playbooks.md`.**7576### 6. Metrics, reporting, and governance7778Track RTA vs RTO, restore success, test coverage, and NIST CSF Recover alignment for stakeholders.7980**See `references/metrics_reporting_and_governance.md`.**8182## Outputs8384- **Resilience architecture** — tiers, dependencies, backup/immutability design, failure domains85- **RTO/RPO register** — per service with strategy, owner, last test, and known gaps86- **Playbook pack** — attack-scenario sequences with decision gates and IR handoffs87- **Test report** — scope, RTA/RPO achieved, integrity checks, findings, remediation backlog88- **Chaos/game-day summary** — hypothesis, blast radius, controls validated, follow-ups89- **Resilience dashboard brief** — KPIs, trend, top risks (engineering lens; not legal advice)9091## Principles9293- **Engineer for compromise** — assume attacker presence; prefer rebuild and immutable recovery paths94- **Test restores, not jobs** — backup success ≠ recoverable; measure RTA and data integrity95- **Recover security first** — identity, logging, and detection before convenience workloads96- **Separate roles** — resilience engineering complements BCM policy and IR command97- **Evidence by design** — every tier and playbook links to a test or exercise with dated results
daemon-blockint-tech